Secure Direct Communication with a Quantum One-Time-Pad 
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Quantum secure direct communication is the direct communication of secret messages without 
first producing a shared secret key. It maybe used in some urgent circumstances. Here we propose 
a quantum secure direct communication protocol using single photons. The protocol uses batches 
of single photons prepared randomly in one of four different states. These single photons serve as a 

' one-time-pad which are used directly to encode the secret messages in one communication process. 

, We also show that it is unconditionally secure. The protocol is feasible with present-day technique. 
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■ Quantum key distribution(QKD) provides a novel way for two legitimate parties to establish a common secret key 
' over a long distance. Its ultimate advantage is its unconditional security, the feat in cryptography. Combining with 
, the one-time-pad scheme in which the private key is as long as the messages, secret messages can be communicated 

safely from one place to another place. QKD has progressed quickly 1] since Bennett and Brassard designed the 
orig inal QKD protocol '2'|. 

Recently, a novel concept, quantum secure direct communication (QSDC) is proposed and pursued^, |M 1^- 
\ Different from QKD whose object is to establish a common random key between the two remote parties of commu- 
te ' nication, QSDC is to transmit the secret message directly without first creating a key to encrypt them. In 2002, 
^-H Beige et al. presented a QSDC scheme based on single-photon two-qubit states jj]. In this scheme the message can 
1^ . be read after a transmission of an additional classical information for each qubit, which is similar to a QKD scheme 
as each bit of key can represent one bit of secret message with an additional classical information, i.e, retaining or 
flipping the bit value in the key according to the secret message. Bostrom and Felbinger put forward a Ping-Pong 
QSDC schemejlj using Einstein-Podolsky-Rosen (EPR) pairs'^ as quantum information carriers. It is secure for key 
distribution, but is only quasi-secure for direct secret communication if perfect quantum channel is used. However it 
is insecure even for QKD if it is operated in a noisy quantum channel, as shown by WojcikQ. The Ping-Pong protocol 
+^ ' can be modified for secure QKD by taking into account of the procedures proposed by WojcikQ. Cai found that 
^ the Ping-Pong scheme can be attacked without eavesdropping Meanwhile, we proposed a two-ste p se cure QSDC 
^ protocol with EPR pairs transmitted in blocks 5] by modifying a QKD protocol based on EPR pairs |lClj. In Ref.|^, 
Cai modifies the Ping-Pong scheme by replacing the entangled photons with single photons in mixed state. However 
ILV ■ it is unsafe in a noisy channel, and is vulnerable to the opaque attack 11]. 
. ^ ] QSDC maybe important in some applications. For instance when the transmission time is urgent, or the transmission 

■ maybe subject to the danger of destruction. Furthermore, as the technologies for quantum information improves, the 
?H ] efficiency of quantum transmissions maybe greatly increased compared to the low rate transition in present-day 
. . t laboratories, then secure direct quantum communication may well become highly demanded and become an elegant 

means for secret communication. 

In this paper, we propose a QSDC scheme that uses single photons in batches. The states of the single photons 
themselves serve as a one-time-pad, and they are encoded with the secret message by two different unitary operations. 
The scheme maybe viewed as a modification of the well-known BB84 QKD scheme. Comparing with protocols using 
EPR pairs, this scheme is practical and well within the present-day technology. All in all, it inherits the unconditionally 
security merit of the BB84 QKD scheme, and renders it an attractive choice in practical applications. Here we first 
present our QSDC protocol, then we analyze its security by reducing it to the BB84 QKD protocol. 

The security of QKD is the capability of the users to detect eavesdropping. If no eavesdropping is detected 
or the eavesdropping is negligible, the transmissions are retained, and after some treatment, a sequence of secret 
key is produced. Otherwise the transmissions are abandoned. However the requirement for secure direct quantum 
communication is even higher. In addition to the ability to detect eavesdropping, the users must ensure that the 
secret messages encoded do not leak to eavesdropper before she is detected. For instance in a noiseless channel, the 
Ping-Pong protocol is secure for quantum key distribution, but is insecure for direct communication as it does not 
satisfy the second requirement and some message has already leaked to Eve, the eavesdropper, before she is detected. 

Here we first describe the details of our quantum-one-time-pad QSDC scheme. Suppose Alice wants to transform a 
secret message to Bob. Similar to the BB84 QKD protocol 2], Alice and Bob use two measuring basis(MB), namely 
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the rectilinear basis, i.e., { \H) = |0), \V) = |1)} and the diagonal basis, i.e., {\u) = ^(|0) + |1)), \d) = -j^{\0) - |1))} 
where \H) and \V) are the horizontal and vertical polarization states respectively. As in the BB84 QKD protocol, the 
0) and \u) states represent the binary value 0, and the |1) and \d) states represent binary value 1. For simplicity we 
call them as the plus- measuring-basis (Plus-MB) and the cross-measuring-basis(cross-MB) respectively. We assume 
ideal noiseless channel first. The case with a noisy channel will be discussed later. The quantum-one-time-pad QSDC 
protocol contains two phases: 

(1) The secure doves sending phase. Bob prepares a batch of polarized single photons and sends the photons to 
Alice. Each photon is randomly in one of the four polarization states: \H), \V), \u) and \d). We call this batch of 
photons at this stage, the A-batch photon as it goes toward Alice. After receiving the batch of photons, Alice and 
Bob check eavesdropping by the following procedure. Alice selects randomly a sufficiently large subset of photons 
from the A-batch, which we call the S-batch, and she measures each of them using one of the two measuring-basis 
randomly. Alice tells Bob the positions, and the measuring-basis and the result of the measurement for each of the 
sampled photons in the S-batch. With this knowledge. Bob can determine, through the error rate, whether there is 
any eavesdropping. The photons left-over in the A-batch after the eavesdropping is called the B-batch. Apparently, 
the B-batch is the difference set of the A-batch and the S-batch: B = A — S. If the error rate is high. Bob concludes 
that the channel is not secure, and the communication is halted. Otherwise, Alice and Bob continues to the next 
phase. This is just like that Bob sends a batch of doves to Alice for carrying the message back. This is similar to Ping 
in the Ping-Pong protocol, but instead of a single Ping, our protocol uses a batch of Ping's. In addition to operating 
in batches, another major difference between our protocol and the Cai protocol^ is that we use four states, but only 
the \H) and |u) states are used in Cai's protocol at this phase, and this makes the Cai protocol insecure under an 
opaque attack 

(2) The message coding and doves returning phase. After the security of the B-batch is completed, Alice encodes each 
of the photons in the B-batch with one of the two unitary operations, / — |0) (0| + 11) and U = iay — |0) (1| — |1) (0| 
respectively, according to the secret message. If the secret message is 0, then operation / is performed, and if it is a 
1 the iay operation is performed, the same as that in Ref. . The nice feature of the U operation is that it flips the 
state in both measuring basis, 

U\0) C/|1) = |0), (1) 

U\u) U\d) = -\u). (2) 

After encoding the photons in the B-batch, Alice returns them to Bob. As the A-batch is prepared by Bob, Bob 
knows the measuring-basis, and the original state of each photon in the B-batch. He uses the same measuring-basis 
when he prepared the photon to measure the photon, and reads out the secret messages directly. To guarantee the 
security of the whole communication process, it is necessary for Alice to use randomly some of the B-batch photons as 
checking instances. She will announce publicly the positions and the coded bit values of these checking photons after 
the transmission of a batch is completed. This measure gives Alice and Bob an estimate whether there is an Eve in 
the line to intercept their communication. But Eve can only interrupt their transmission in this phase and could not 
get any useful information about the secret message since Eve can not get any useful information during the B-batch 
transmission, in the same way as in the two-step protocol^. 

We now discuss the unconditional security of this quantum-one-time-pad QSDC scheme. First we notice that the 
encoding of secret messages in the second phase(doves returning phase) is identical to the process in a one-time-pad 
encryption where the text is encrypted with a random key as the state of the photon in the B-batch is completely 
random. In a one-time-pad encryption, it is completely safe and no secret messages can be leaked even if the cipher- 
text is intercepted by the eavesdropper. Here the quantum-one-time-pad QSDC protocol is even more secure than the 
classical one-time-pad in the sense that an eavesdropper can not even intercept the whole cipher-text as the photons' 
measuring-basis is chosen randomly. Thus the security of this QSDC protocol depends entirely on the first step when 
Bob sends the A-batch to Alice. 

The process for ensuring a secure A-batch of photons is similar to that in BB84 QKD protocol. The difference 
between this protocol and BB84 QKD is that the B-batch photons are stored, whereas all the photons are measured 
one by one in the BB84 QKD scheme. The security of BB84 QKD is assured by means that Alice and Bob choose 
randomly sufficient instances for checking eavesdropping. The process of the QSDC scheme before Alice encodes her 
message using the unitary operation is in fact identical to the BB84 QKD process. The BB84 QKD has been proven 
unconditional secure by several groups [l^- The BB84 QKD protocol is secure even when the channel is noisy. In this 
way, the process for establishing a secure quantum channel in this QSDC scheme is proven unconditionally secure by 
this observation. 

The Holevo bound states that the mutual information between Bob and Eve satisfiesflSl 
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where p = X] PxPx and px is a quantum state prepared by Bob with probabiHty P^, and S{pi) = —tr{pi log2 Pi) is the 

X 

Von Neumann entropy of state PilXS]. If Bob prepares the four states, \H), \V), \u) and \d) symmetrically, then the 
binary entropy of states prepared by Bob is H{B) = ^ —Px log2 Px — 2. Thus we have 

X 

H{B:E)<S{p)-Y,PxS{px)<H{B). (4) 

X 

That is to say, Alice and Bob can share a sequence of quantum states securely (Tsj. 

The essential difference between this protocol and the Ping-Pong protocol 4J and its variant ,6J is that the security 
of the quantum channel is analyzed first in a batch after batch manner and the encoding of the message is done only 
after the confirmation of the security of the quantum channel, while in the Ping-Pong protocols the security check 
and the encoding of messages are done concurrently. Since the security of the channel is insured first in this quantum 
one-time-pad protocol, Eve can get nothing even though she monitors the rest of the process of communication. 
Another major difference between our protocol and Cai protocol is the different sets of states in the doves sending 
phase. The asymmetry of the |0) and |1) components in Cai's protocol makes it insecure under the opaque attack. 

In the implementation of this quantum-one-time-pad QSDC protocol, single photon source and the technique for 
storing quantum states are required. These techniques are principally available, for instance, the single photon 
source 14], information storage through electromagnetic induced transparency^^. Of course, they still need further 
improvement for perfection for realistic applications. At present, this protocol can be implemented with existing 
techniques. The storage of photons can be done by optical delays in a fibre as has been proposed in Ref.|5i], shown 
in Fig^ In practice, there are also losses in the transmission lines, error correcting techniques are necessary. There 
have already been quite a few good correcting codes, for instance, in references [la IITI . In fact, many of the state 
of art experimental QKD setups use the Faraday mirrors where the photons are sent to one party and then returned 
back to the sender. It is quite possible that these setups maybe adapted to realize this QSDC protocol. 

Before we conclude, it is worthwhile to inspect the basic requirements for quantum secure direct communication. 
First, eavesdropping check before the message being encoded must be performed first. This is necessary for secure 
communication. Secondly, since eavesdropping can only be performed through sampling, it is necessary to perform 
the communications in a batch after batch manner. A batch of single photons is transmitted first from one place to 
another place. Its security is assured by sampling a sufficiently large subset of instances from the batch. Then this 
secured batch is used to encode the secret message and transmitted to the other location. 

Finally, it is seen here that quantum secure direct communication does not necessarily need EPR pairs as the 
information carrier, therefore quantum entanglement and non-locality are not the necessary requirements for QSDC. 
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FIG. 1: Implementation of the QSDC with optical delays. CE is the eavesdropping check; SR represents an optical delay; 
Switch is used to control the quantum communication process, if the batch of photons are safe, the switch is on and the message 
coding is performed; CM encodes the secret message. Ml and M2 are two mirrors for in this simple illustrative set-up. 
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